Welcome to Asphalia Analytics

Discover your
Cybersecurity Weaknesses
before Hackers do.

Screenshot of the Asphalia Analytics app
Security • 8 min read • October 16, 2026

Graeber Counted Five. I Keep Meeting Seven.

A field guide to bullshit jobs, written from the visitor's chair

Bullshit Jobs, Collector's Edition: seven trading cards

In 1930, John Maynard Keynes predicted that by the end of the century technology would let us work fifteen hours a week. The technology arrived. The fifteen-hour week did not.

In 2018, the anthropologist David Graeber offered an explanation: we spent the productivity gains inventing work. He called the result bullshit jobs: paid employment so pointless, unnecessary or pernicious that even the person doing it cannot justify its existence.

I went back to Graeber after reading Alex McCann's piece "The 5 types of bullshit job" on The Still Wandering, which revisits the typology in the age of AI. And I realised I have a slightly unusual vantage point on it.

I'm an independent consultant. I work for a lot of small clients, public and private. Which means I walk into a new organisation more often than most people change phones. Different sectors, different sizes, different logos on the coffee mugs.

Same cast of characters.

Here they are: Graeber's five, as I meet them in the wild, plus two species that have flourished since he drew up the list.


1. The Flunky

Card 01 - The Flunky

Habitat: wherever someone needs to be seen having someone.
Call: "We've brought in an expert."

Graeber's flunky exists to make someone else look important: the receptionist nobody needs, the doorman who signals status.

The modern variant is the outside expert hired so that someone can say an expert was hired. You arrive with a title on the contract (sometimes a grand one) and discover on day one that your mandate stops at the IT department's door. You are expected to advise on decisions that only people you will never meet can take.

The title is for the org chart. The work is whatever needs doing that week. Nobody is lying, exactly. Having someone is the deliverable.

2. The Goon

Card 02 - The Goon

Habitat: any market where the other side has one too.
Call: "Please complete the attached questionnaire (312 questions)."

Goons exist because the opponent employs goons. Lawyers because the other side has lawyers. Lobbyists because the other side lobbies.

My favourite specimen is the supplier questionnaire. Company A sends 312 questions to Company B. Company B answers with documents originally written for Company C's questionnaire. Nobody reads the answers. Next year, both sides send longer ones.

An arms race in which the ammunition is PDF.

3. The Duct Taper

Card 03 - The Duct Taper

Habitat: downstream of every decision nobody owns.
Call: "Can you just fix it?"

The duct taper fixes problems that shouldn't exist.

In every organisation I visit, something is broken, and someone, often me, is asked to fix it. That part is normal. Things break.

What's abnormal is what never happens next: nobody asks why it broke. No post-mortem. No root cause. No "who decided this, and what did we learn?" The fix is the end of the story. So next year the same thing breaks, and the same person is called back with the same roll of tape.

Duct taping isn't really a job. It's the absence of accountability, turned into a job.

4. The Box Ticker

Card 04 - The Box Ticker

Habitat: the week before the audit.
Call: "Do we have a document for that?"

Box tickers create the appearance that something is being done.

Honesty requires nuance here. Some boxes genuinely protect people. Others exist only to be ticked. The skill nobody pays for is telling the two apart.

Picture a policy: written, reviewed, approved, signed, filed, and never read by the people whose behaviour it was meant to change. It isn't useless. It passes the audit. That's precisely the problem: passing the audit has quietly become the purpose.

5. The Taskmaster

Card 05 - The Taskmaster

Habitat: one floor up.
Call: "Let's align on this."

Graeber split taskmasters into two kinds: those who supervise people who don't need supervising, and those who invent work for others to do.

Picture a reporting template. It was created to answer a question someone asked once, three reorganisations ago. Every month, five people fill it in. Every month, one person forwards it. Nobody remembers the question, and nobody dares to be the one who stops filling it in.

What strikes me from the visitor's chair is that they are no longer exceptions. They have become a layer. And that layer has produced two species Graeber's typology doesn't quite capture.


6. The Common-Sense Executive

Card 06 - The Common-Sense Executive

Habitat: the top of the org chart, increasingly.
Call: "It's just common sense."

Management used to require three things: competence in the domain, the ability to lead people, and ownership of decisions and their consequences.

The Common-Sense Executive has replaced all three with one: common sense.

Common sense is wonderful. It's also what everybody has. When the subject is technical, the executive doesn't need to understand it. Common sense will do. When people struggle, they don't need managing. Common sense will do. And when something fails, nobody is responsible, because common sense was applied, and you can't blame common sense.

Picture an incident. It's fixed by Friday. On Monday, the executive thanks everyone for their responsiveness. Nobody asks how it happened. The question would imply that someone, at some point, decided something.

7. The Meeting Professional

Card 07 - The Meeting Professional

Habitat: middle management, in colonies.
Call: "Let's take this offline and set up a follow-up."

The Meeting Professional's product is their calendar.

Picture the weekly steering committee. Eight people, one hour, a slide titled Status that hasn't changed since Q2. Action items are assigned to the one person in the room who actually does the work. The next meeting is scheduled. Decisions taken: zero. Decisions belong to the meeting after next.

Now multiply that by a few hundred. It's the organisation with fifty project managers and one person to deliver all fifty projects.

The Meeting Professional sincerely believes that meetings are work. The people doing the work beg to differ. Worse, the species isn't merely useless: since nothing is ever decided, it also blocks. Every hour in the room is an hour not spent on the thing the room is about.


Field check

Your turn. For each card: 0 if you've never met it, 1 if you've met it once, 2 if it's in your calendar every week. Maximum score: 14, before the bonus.

Field check: how often have you met them?

My score: 11 out of 14, no bonus.

There is one more card in the series. It's worth a bonus of +5, and I have almost never pulled it.

Card 08 - Someone who asks why it broke

I'm still hunting. If you've met one, I'd like an introduction. And yours? Tell me your score in the comments.


Why they survive

None of this is mysterious. I see three mechanisms, everywhere.

Friendship. People hire people they like, and protect people they hired.

Inertia. Where I work, we don't really fire people. We move them sideways. Underperformance doesn't end; it relocates.

The chain of mutual protection. A manager cannot disown the manager below them. Admitting that your direct report is useless means admitting that you managed a useless person, which reflects on you. So each layer vouches for the layer beneath it, all the way down.

The competence inversion

Put those three together and you get something more corrosive than waste: a structure in which the people who produce report to the people who meet.

The most competent person in the room, the clearest communicator, the one who actually ships, is often at the bottom of the chart. Paid less, and managed by people whose main output is managing. Graeber noticed it too: the more useful a job is, the less it tends to pay.

The damage isn't that the Meeting Professional exists. It's what their existence tells everyone else: competence is not what gets rewarded here. People notice. The good ones leave, or they stop trying. Both are rational.


And me?

I promised myself I'd hold up the mirror too.

A consultant is a duct taper by design. I'm paid to fix, rarely mandated to fix causes. Coming back next year to fix the same thing is, uncomfortably, a business model. Some of my deliverables are boxes. I tick them, knowing exactly what they are.

And I leave every single engagement exhausted. Not from the work. Real work tires you, which is fine. From the absurdity. Absurdity drains you, and there's no weekend long enough to refill it.

I went independent partly to escape all this: more variety, fewer layers. It turns out variety mostly means meeting the same seven characters in more places.


Something has to change

I won't offer a ten-step framework. It would just become another box to tick.

Just four questions worth asking in your next steering committee, if you can get one on the agenda:

  1. When something breaks, does anyone ask why? Is anyone's name attached to the answer?
  2. If we cancelled half our recurring meetings, what would actually stop?
  3. Do the people who produce the work have a say in the decisions about it?
  4. Who here could disappear tomorrow without anyone noticing for a month? And what does it say about us that we already know?

McCann predicts AI will turn the vague feeling that a job is pointless into a concrete fact. Maybe. Or maybe AI will simply write the minutes of meetings nobody needed, faster.

The tool won't decide. People will. Something has to change. And it won't be changed by the people who benefit from it staying the same.


Sources: David Graeber, Bullshit Jobs: A Theory (2018). John Maynard Keynes, "Economic Possibilities for our Grandchildren" (1930). Alex McCann, "The 5 types of bullshit job", The Still Wandering (Substack). The scenes in this piece are composites, not portraits of any organisation.

Security • 1 min read • February 16, 2026

CRA Scope Assessment Tool — Promotional Post Outlines

Is your product subject to the EU Cyber Resilience Act?

The CRA (Regulation EU 2024/2847) applies to virtually all products with digital elements sold in the EU — with full compliance required by 11 December 2027 and reporting obligations starting 11 September 2026.

We built a free, privacy-first assessment tool that tells you in under 5 minutes:

  • Whether your product is in scope
  • Your classification (Default, Important, Critical)
  • Which conformity path applies
  • Your obligations based on your role in the supply chain

No registration. No data collection. Works offline.

Try it now: cra.asphaliaconsulting.be

Image

Security • 1 min read • January 29, 2026

Cyber Security Act 2

Seven years after the original Cybersecurity Act, the EU is ready for version 2.0. CSA2 brings mandatory supply chain security measures, stronger ENISA capabilities, and the ability to force the removal of high-risk components from critical infrastructure — even retroactively.

CSA2 is here, and it's not just an update — it's a reset. The European Commission's January 2026 proposal tackles supply chain risks head-on, with new powers to ban high-risk vendors from 5G networks and critical sectors, a reinforced ENISA, and a certification framework that finally moves beyond voluntary adoption.

Image

Security • 1 min read • January 29, 2026

NIS2 2026 Amendments

If you've just finished mapping your NIS2 obligations, you might not want to hear this — but the directive was explicitly designed to evolve, and the first major review cycle is already approaching in 2026.

Understanding what the European Commission will be evaluating, from sector coverage to cross-border coordination mechanisms, can help you build a compliance programme that won't need a complete overhaul when the amendments arrive. Here's a breakdown of what to watch for.

Image

Security • 1 min read • January 29, 2026

NIS2 2026 Updates

The European Commission just announced targeted amendments to NIS2 that promise to simplify compliance for 28,700 companies - but does 'simplification' really mean easier, or just different hoops to jump through?

Image

Security • 1 min read • December 6, 2025

Use Case 1

NIS2 Compliance: Know Your Attack Surface

The Challenge

Since October 2024, NIS2 requires essential and important entities to "take appropriate and proportionate technical, operational and organizational measures to manage the risks posed to the security of network and information systems" (Article 21). This explicitly includes vulnerability management and knowledge of your exposed assets.

For many SMEs, this represents a significant challenge: how do you identify what attackers can see of your infrastructure without an in-house security team or expensive enterprise tools?

Our Solution

Asphalia Analytics provides a complete inventory of your external attack surface with risk prioritization aligned to NIS2 requirements:

  • Asset Discovery: Identification of all your exposed assets (domains, subdomains, IPs, services)
  • Shadow IT Detection: Uncovering forgotten or unknown assets that could be exploited
  • Vulnerability Assessment: Detection of exploitable vulnerabilities on exposed services
  • Compliance-Ready Reporting: Report directly usable for your compliance audits
  • Prioritized Remediation: Actionable recommendations ranked by risk level

Expected Outcome

Documentation ready to demonstrate your compliance with Article 21.2 (vulnerability management) during regulatory inspections or audits.

Security • 1 min read • December 6, 2025

Use Case 2

Cyber Resilience Act: Assess Your Risks Before Market Launch

The Challenge

The Cyber Resilience Act (CRA) requires manufacturers of products with digital elements to perform a cybersecurity risk assessment before placing products on the market. This assessment must cover potential vulnerabilities and exploitation risks throughout the product lifecycle.

For connected device manufacturers, this means not only securing the device itself but also the entire supporting infrastructure: update servers, management portals, APIs, and cloud backends.

Our Solution

Before launching a connected product, we analyze your external exposure:

  • Support Infrastructure Assessment: Security posture of your portals, APIs, and update servers
  • Credential Leak Detection: Discovery of potentially leaked credentials or secrets in public repositories
  • Cloud Configuration Review: Analysis of cloud services associated with your product
  • Certificate Chain Validation: Verification of certificates and their trust chain
  • Third-Party Dependency Analysis: Identification of external services your product relies on

Expected Outcome

An external assessment report documenting your due diligence, a key element of your CRA technical file demonstrating proactive security measures.

Security • 1 min read • December 6, 2025

Use Case 3

M&A Due Diligence: Evaluate the Cyber Risk of Your Target

The Challenge

During an acquisition, the target's cyber risk becomes your risk. Undiscovered vulnerabilities, shadow IT assets, and poor security practices can represent significant hidden costs post-acquisition. Traditional due diligence often overlooks cyber exposure, leaving acquirers with unexpected remediation costs and potential liability.

The challenge is compounded by the need to assess security posture without alerting the target or requiring access to their internal systems during early-stage negotiations.

Our Solution

Without any access to the target's systems (100% external and non-invasive assessment), we provide:

  • Complete Attack Surface Inventory: Full mapping of the target's external footprint
  • Critical Risk Identification: Exposed services, known vulnerabilities, misconfigurations
  • Data Leak Detection: Discovery of existing credential leaks, exposed documents, or sensitive data
  • Comparative Security Score: Benchmarking against industry standards and peers
  • Historical Analysis: Changes in security posture over time where data is available

Expected Outcome

A cyber due diligence report enabling informed negotiation and post-acquisition remediation planning. Identify potential deal-breakers or negotiate price adjustments based on discovered security debt.

Security • 1 min read • December 6, 2025

Use Case 4

Supply Chain Security: Vendor Risk Assessment

The Challenge

NIS2 and DORA mandate the assessment of your critical suppliers' security posture. Self-declaration questionnaires are no longer sufficient—regulators expect objective, verifiable evidence of supply chain risk management.

With supply chain attacks increasing dramatically, organizations need continuous visibility into their vendors' external security posture, not just point-in-time assessments based on questionnaires that may not reflect reality.

Our Solution

Objective and verifiable assessment of your suppliers' attack surface:

  • Independent Analysis: No reliance on vendor self-declaration
  • Sector Benchmarking: Comparison against industry security standards
  • Supply Chain Risk Mapping: Identification of shared dependencies and concentration risks
  • Continuous Monitoring Option: Periodic reassessment to track security posture changes
  • Evidence-Based Reporting: Documentation suitable for regulatory compliance

Expected Outcome

Documentation compliant with NIS2 Article 21.2(d) requirements on supply chain security. Defensible evidence of your vendor risk management program for auditors and regulators.

ISO 27001 • 1 min read • November 4, 2025

5.01 - Policies for Information Security - OnePager

Image

Tags: security-policy
Page 1 of 11Next →